Judy Pascale: 'I'll be very happy' to testify about Suffolk cyberattack

Outgoing Suffolk County Clerk Judith Pascale said a new special legislative committee investigating the crippling ransomware attack on county government need not issue subpoenas for her testimony — she’ll give it any time they ask.

In a wide-ranging interview with Newsday, Pascale said she would answer questions about her monthslong efforts to get additional computer security, as previously reported by Newsday, and warnings by her staff about potential intrusions in the months before the Sept. 8 cyberattack.

Pascale, a Republican who lost the GOP primary for reelection and is leaving office this month, also addressed a bitcoin-mining operation uncovered in her office in 2021, and detailed the impact of the larger county computer system lockdown on clerk functions. 

As for the newly formed six-member legislative panel that will begin work next year with subpoena power to probe the cyberattack, Pascale said: "They don’t have to subpoena me. I’ll be very happy to let them know what I know and what happened. … I’ll be there whenever they want me to.”

Her comments Monday came after a report in Newsday on Sunday that the clerk’s office was the first to give the county’s computer department notice of a “radical ransomware attack.”

Newsday reported it took the county more than four hours to fully shut down access to the rest of its network.

Clerk staff sought better computer security

As the attack and its aftermath continue to affect government services, Pascale confirmed Newsday reports based on emails that she and her staff had sought higher levels of security.

Pascale said she requested a new firewall to protect the clerk’s dedicated computer servers in the months before the attack.

Pascale said the Palo Alto Networks firewall, while delivered, "is not up yet," although county officials have assured her there are "sufficient security measures in place that would protect my data."

Suffolk County spokeswoman Marykate Guilfoyle said Pascale’s assertion that the firewall has not been configured was “unequivocally false.”

Guilfoyle said in a statement to Newsday: “A Palo Alto Firewall was in fact put in place in the Clerk domain in mid-September as part of our efforts to protect the Clerk’s environment and restore the vital public title search application in a safe and secure manner.”

Guilfoyle continued: “Individuals who continue to engage in reckless speculation prior to the completion of the county’s digital forensic examination are unfortunately acting to protect their own self-interest rather than the interests of the public.”

The clerk's office's public-facing computers still are without outside internet connections, and most online services are not yet available, Pascale said. 

Funding roadblocks

Pascale said the Suffolk County Legislature’s Ways & Means committee on three occasions tabled funding for security upgrades until late June.

That was when Pascale ran into additional roadblocks from the county’s information technology department, which said her requests “were not supported,” according to Pascale and emails.

Legis. Kevin McCaffrey (R-Lindenhurst), legislative presiding officer and a member of the investigative panel, denied any effort to delay computer upgrades for the clerk's office. 

"There are some allegations that we stalled improvements to computer security, and that clearly is not the case," McCaffrey told Newsday.

McCaffrey said he was "not blaming anybody" for the cyberattack until he sees a report being prepared by a forensic accounting team for Suffolk County.

"We just want to get systems restored and make sure it doesn't happen again," McCaffrey said.

Lawmaker wants probe 

McCaffrey also said he wants the special committee to examine how a bitcoin-mining operation was able to operate in the clerk's office for months last year before the Suffolk County district attorney arrested a veteran computer tech in the office.

“I think the county clerk needs to step back a little bit and look in her own backyard,” McCaffrey said at a news conference Monday.

The employee, Christopher Naples, 43, of Mattituck, pleaded not guilty last year to charges in connection with the operation, which the district attorney said cost county taxpayers at least $6,000 for electricity and put important county infrastructure at risk.

The case is pending in Southampton Town Court. 

Pascale said it was “ludicrous” to blame the bitcoin probe for delays in her office getting the higher levels of security it requested, as McCaffrey has said previously. 

Pascale also asserted that the alleged bitcoin operation by Naples, who remains on the payroll, was “never on the network.”

Naples was “basically using the county’s electricity. It never impacted the network and it certainly never corrupted any of the equipment," Pascale said.

Naples' attorney, William Keahon, did not return calls seeking comment.

More broadly, Pascale, who has served as county clerk since 2006, acknowledged some of the computer equipment in her office “was a bit antiquated.”

That was why she kept sounding the alarm about security, she said.

"We weren’t the boy who cried wolf,” Pascale said. “There was a genuine concern that this [cyberattack] could happen."

Pascale said she believed the effects of the cyberattack, if not the attack itself, “could have been mitigated,” if the county had prepared fully.

"I think it maybe would not have happened in the magnitude that it has," she said.

With Vera Chinese

By Mark Harrington

mark.harrington@newsday.comMHarringtonNews

Mark Harrington, a Newsday reporter since 1999, covers energy, wineries, Indian affairs and fisheries.